Trusting a root certificate on MacOS 11.4

How can I "Always Trust" a root certificate on MacOS Big Sur 11.4? I have double clicked the certificate in order to evaluate the certificate but when I choose "Always Trust" in the drop down box and press OK, it does not update the settings for the certificate. The certificate is within KeyChain Access - System Keychains - System

MacBook Pro 13″, macOS 11.4

Posted on Jun 17, 2021 4:30 PM

Similar questions

Certificaat issuer is not trusted The root certificate "Staat der Nederlanden Services CA - G3" is the only certificate that is not trusted on my iMac. So I cannot visit all Government sites in the Netherlands... The specific certificate (although the latest update with enddate 2028) is not listed in my key chain. Previous (older) certificates of this certificate do exist in the keychain. All other root certificates work well. Does anyone has a suggestion?
1135 2
A 3rd-party installer made certificate trust setting changes: how to identify the changes in Keychain Access.app? Hi, I have a question about how to identify changes to my certificate trust settings made by a 3rd-party installer. I just installed a macOS utility called "Plantronics Hub", which is used to manage settings and firmware for audio headsets made by Plantronics (now Poly). During the install process, a dialog popped up with a Touch ID prompt, saying the installer wanted to "make changes to the System Certificate Trust Settings". While my brain was still processing what that meant, my finger had already touched the Touch ID sensor and the install completed. I was left thinking "Oh no, what have I done!", and it was too late to stop it. I then opened Keychain Access.app to see if I could identify what changes the installer had made to my certificate trust settings. This is where my uncertainty begins. In Keychain Access.app, under the "System" keychain, I immediately saw a new self-signed root certificate called "Plantronics Hub" which says "This certificate is marked as trusted for all users". So this is almost certainly what it installed - or _one_ of the things it installed. And clearly it's a problem: I don't want my system trusting random self-signed root certificates from hardware vendors. I only want my system trusting bona fide Certificate Authorities. If this certificate's private key was ever compromized, a malicious actor could then issue arbitrary certificates in any domain, and my macOS machine would blindly trust them! So obviously I'll be deleting that. But how can I tell if this was the _only_ change to my certificate trust settings made by this installer? Ideally there'd be some kind of "recently updated" view in Keychain Access.app, but there is no such view. I can see when certificates were issued and when they will expire - but I cannot see who installed them or when they were installed. There's no obvious way to tell which certificates were pre-installed by Apple, and which have been added later, and the difference between the "System" keychain and the "System Roots" keychain is not clear or explained in the documentation. My concern is: what if the installer made other changes? How can I tell? Any help appreciated.
1613 2
MacBook Keychain User Sub CA1 Hey guys, On my new MacBook I discovered that in the Login section of Keychain some of the certificates are not trusted. One of them is the following: "Basic Attestation User Sub CA1" – certificate not trusted. Also, In the System section the following certificates have "not being verified by a third party": com.apple.kerberos.kdc com.apple.systemdefault Any ideas why this is happening?
4533 13

3 replies

Barney-15E

Level 10

122,600 points

Jun 17, 2021 4:44 PM in response to dowalker

Does it ask you to authenticate? Since it is the System keychain, it should ask for authentication.

Is your account admin-capable?

Maybe try unlocking the System Keychain, first.

dowalker Author

Level 1

8 points

Jun 17, 2021 5:42 PM in response to Barney-15E

It is asking me to select the 'appropriate trust policy to evaluate" and gives me the following options: S/MIME , SSL, Generic (certificate chain validation only), Code Signing

How do I check / know if my account is admin-capable?

Barney-15E

Level 10

122,600 points

Jun 17, 2021 8:16 PM in response to dowalker

It asks that when you just change the trust setting? I’ve never seen that.

In Users & Groups System Preferences, it should show “Admin” under your account name.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Trusting a root certificate on MacOS 11.4